Micro Focus Enterprise Developer and Enterprise Server Cross-Site Request Forgery Vulnerability (CNVD-2017-26443)

Micro Focus Enterprise Developer and Enterprise Server are both products of Micro Focus, a British company. micro Focus Enterprise Developer is a set of integrated development environments for the mainframe. enterprise Server is a production deployment platform for mainframe programs. Enterprise...

This Week in Security News

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. Below you’ll find a quick recap of topics followed by links to news articles and/or our blog posts providing additional insight. Be sure to check back...

smartessentialoils.younglivingworld.com XSS vulnerability

Vulnerable URL: http://smartessentialoils.younglivingworld.com/MainFrame.asp?BodyFrame=1"...

EMC Mainframe Enablers ResourcePak Base Local Elevation of Privilege Vulnerability

EMC Mainframe Enablers ResourcePak Base is a set of mainframe enabler components from EMC Corporation. A security vulnerability exists in EMC Mainframe Enablers ResourcePak Base. An attacker could exploit this vulnerability to compromise a vulnerable system...

Privilege escalation

EMC Mainframe Enablers ResourcePak Base versions 7.6.0, 8.0.0, and 8.1.0 contains a fix for a privilege management vulnerability that could potentially be exploited by malicious users to compromise the affected system...

CVE-2017-4982

EMC Mainframe Enablers ResourcePak Base versions 7.6.0, 8.0.0, and 8.1.0 contains a fix for a privilege management vulnerability that could potentially be exploited by malicious users to compromise the affected system...

CVE-2017-4982

EMC Mainframe Enablers ResourcePak Base versions 7.6.0, 8.0.0, and 8.1.0 contains a fix for a privilege management vulnerability that could potentially be exploited by malicious users to compromise the affected system...

CVE-2017-4982

CVE-2017-4982 affects EMC Mainframe Enablers ResourcePak Base versions 7.6.0, 8.0.0, and 8.1.0. The provided documents describe a privilege management vulnerability that could allow a malicious user to compromise the affected system, and note that a fix exists for these versions. No explicit root...

CVE-2017-4982

EMC Mainframe Enablers ResourcePak Base versions 7.6.0, 8.0.0, and 8.1.0 contains a fix for a privilege management vulnerability that could potentially be exploited by malicious users to compromise the affected system...

JCL to Escalate Privileges

Elevate privileges for user. Adds SYSTEM SPECIAL and BPX.SUPERUSER to user profile. Does this by using an unsecured/updateable APF authorized library APFLIB and updating the user's ACEE using this program/library. Note: This privesc only works with z/OS systems using RACF, no other ESM is...

cics-enum NSE Script

CICS transaction ID enumerator for IBM mainframes. This script is based on mainframebrute by Dominic White . However, this script doesn't rely on any third party libraries or tools and instead uses the NSE TN3270 library which emulates a TN3270 screen in lua. CICS only allows for 4 byte transacti...

vtam-enum NSE Script

Many mainframes use VTAM screens to connect to various applications CICS, IMS, TSO, and many more. This script attempts to brute force those VTAM application IDs. This script is based on mainframebrute by Dominic White . However, this script doesn't rely on any third party libraries or tools and...

tn3270-screen NSE Script

Connects to a tn3270 'server' and returns the screen. Hidden fields will be listed below the screen with row, col coordinates. Script Arguments tn3270-screen.commands a semi-colon separated list of commands you want to issue before printing the screen tn3270-screen.lu specify a logical unit you...

Z/OS (MVS) Command Shell, Reverse TCP

Provide JCL which creates a reverse shell This implementation does not include ebcdic character translation, so a client with translation capabilities is required. MSF handles this automatically. This module requires Metasploit: https://metasploit.com/download Current source:...

Generic JCL Test for Mainframe Exploits

Provide JCL which can be used to submit a job to JES2 on z/OS which will exit and return 0. This can be used as a template for other JCL based payloads This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework This is a prototy...

IBM Capacity Management Analytics Local Information Disclosure Vulnerability

IBM Capacity Management Analytics is a suite of capacity management analytics solutions from IBM USA for managing and predicting the usage of IBM zEnterprise infrastructure mainframe computer resources. A local information disclosure vulnerability exists in IBM Capacity Management Analytics. A...

Z/OS (MVS) Command Shell, Reverse TCP Inline

Listen for a connection and spawn a command shell. This implementation does not include ebcdic character translation, so a client with translation capabilities is required. MSF handles this automatically. This module requires Metasploit: https://metasploit.com/download Current source:...

nje-node-brute NSE Script

z/OS JES Network Job Entry NJE target node name brute force. NJE node communication is made up of an OHOST and an RHOST. Both fields must be present when conducting the handshake. This script attemtps to determine the target systems NJE node name. To initiate NJE the client sends a 33 byte record...

Mainframe/System Z Bind Shell

Mainframe/System Z Bind Shell. Shellcode exploit for systemz platform TITLE 'sbshellcode.s x Author: Bigendian Smalls' ACONTROL AFPR SBSHELL CSECT SBSHELL AMODE 31 SBSHELL RMODE ANY SYSSTATE ARCHLVL=2 ENTRY MAIN MAIN DS 0F Begin setup and stack management STM 6,4,1213 store all the registers in o...

IBM launches LinuxONE: Linux-only Mainframe Systems

World's largest hardware supplier of mainframe computers IBM International Business Machine Corp. has launched two mainframe servers that run only on Linux operating system. IBM used RAS as a term to describe the strength of the mainframe computers; RSA stands for Reliability, Availability, and...